Vendor Selection

Where Vendor Risk Actually Concentrates in Selection

Vendor selection fails in an uneven way. The expensive surprise is rarely “we forgot to score the nineteenth feature.” It is usually a strategic or bottleneck buy treated like office supplies, a polished demo that never ran your real workflow, an exit path nobody tested, or a third-party dependency whose security was a checkbox.

Most costly vendor outcomes concentrate in a few bottlenecks - classifying impact and supply risk before the beauty contest, weighting a short list of criteria, proving fit on real scenarios, forcing exit and single-source honesty, and putting cybersecurity supply-chain attention on critical providers. This is not an RFP template farm and not permission to slow every purchase the same way. It is a short guide to putting review time where vendor risk actually concentrates. Same concentration logic when risk is the job: 80/20 in risk management. Adjacent when the vendor sits in your stack: 80/20 in cybersecurity.

Honest scope: Kraljic segmentation, NIST C-SCRM, and breach statistics below are starting maps, not your category strategy. Regulated buys, government acquisition, and sole-source constraints differ. Nothing here is a product endorsement - pair it with your spend history and failure register. Judgment under noise: 80/20 in decision-making.

Classify impact and supply risk before the beauty contest

Peter Kraljic’s purchasing portfolio - usually summarized as the Kraljic matrix - segments purchases by how much they matter to the business and how risky the supply market is, into rough postures: strategic, bottleneck, leverage, and non-critical. The point is not the diagram. The point is unequal governance. A core system of record, a sole-source component, or a logistics partner that can stop customer delivery is not the same decision as a interchangeable SaaS toy. Treat them with the same RFP theater and you either burn months on trivia or under-manage a hinge.

20/80 pattern: a minority of buys - high impact, high supply risk, or both - dominate long-term cost, lock-in, and operational pain.

Ignored majority: equal evaluation depth for every SKU so procurement looks “fair.”

Warning sign: the team debates fonts on a peripheral tool while the payment, ERP, cloud, or sole-source part decision gets a hallway yes.

Action today: for your next three open buys, label each strategic / bottleneck / leverage / non-critical in one sentence (impact + supply risk). Only the first two get a deep process.

Vital criteria beat feature democracy

Scorecards swell because every stakeholder adds a row. Fit usually collapses to a short list: can it do the must-work jobs, what is total cost over the real horizon, can it integrate where your data already lives, will support answer when things break, and can you leave later. The rest are tie-breakers. Quality thinking rhymes when defects concentrate: 80/20 in quality control.

20/80 pattern: three to five weighted criteria usually decide whether a shortlist is honest - or whether the team is optimizing spreadsheet theater.

Ignored majority: forty equal-weight features, half of which nobody will use in year one.

Warning sign: the winning vendor won on “most green cells,” not on the three jobs that pay the bill.

Action today: before demos, write five criteria with rough weights that sum to 100. Freeze the list. Nice-to-haves may break ties only.

Proof: real scenarios over demo theater

Demos are designed to feel complete. Risk hides in your messy data, your edge cases, your integrations, and your busiest week. For high-impact vendors, depth concentrates in a few realistic scenarios - a pilot slice, a scripted workflow with your sample, a reference call with a peer who has your constraints - not in another slide about “AI-powered.” Inventory and fulfillment cousins when the vendor moves physical goods: 80/20 in inventory management.

20/80 pattern: a handful of must-work scenarios usually reveal more fit (or failure) than a full feature tour.

Ignored majority: polished sandbox tours with vendor-chosen happy paths and no time-boxed pilot.

Warning sign: nobody can name the three workflows that would kill the deal if they fail - yet the calendar is full of demos.

Action today: write three failure-killing scenarios for your top strategic/bottleneck buy; require the shortlist to run them with your sample data or a time-boxed pilot.

Exit, switching cost, and single-source honesty

Selection is incomplete if leaving is imaginary. Export formats, data ownership, contract term length, switching labor, and whether a second source even exists decide whether today’s convenience becomes tomorrow’s hostage situation. Bottleneck items in the Kraljic sense - low spend drama, high supply risk - especially punish teams that only negotiated price. Continuity, alternates, and buffers matter more than a pretty discount.

20/80 pattern: a few exit and single-source facts usually dominate regret after year two.

Ignored majority: “we’ll migrate later” with no export test, no second-source sketch, and a multi-year auto-renew.

Warning sign: legal redlines argue liability caps while nobody has exported a full customer or SKU dataset once.

Action today: for one critical vendor (current or shortlisted), write the exit story in five bullets - data out, integrations rebuilt, alternate source, calendar months, who owns the work - and run one export test if you already buy from them.

Third-party security concentrates where criticality does

NIST’s Cybersecurity Supply Chain Risk Management guidance (SP 800-161 Rev. 1) frames C-SCRM as identifying, assessing, and mitigating cybersecurity risks throughout the ICT/OT supply chain across the life cycle - not as a one-time PDF questionnaire. It pushes criticality-aware supplier inventories and risk assessment tied to the systems and missions those suppliers support (NIST C-SCRM overview). Verizon’s 2025 DBIR reports that third-party involvement appeared in 30% of analyzed breaches - double the prior year’s expanded third-party metric (~15%) (Verizon DBIR 2025 Executive Summary). Hedge: definitions and contributor mixes move; the transferable point is structural - vendor and software-supply exposure is large enough to deserve unequal diligence on critical providers.

20/80 pattern: a short list of critical suppliers and software dependencies usually dominates third-party cyber risk relative to the long tail of low-impact tools.

Ignored majority: identical security questionnaires for every vendor, filed and forgotten, while the identity provider and the payment processor get the same attention as a marketing widget.

Warning sign: criticality is not assigned; access scopes are unknown; nobody owns continuous monitoring after signature.

Action today: list your top ten technology/service vendors by blast radius if compromised; assign a criticality level; for the top three, confirm who owns security follow-up and what access they actually have.

Contract clauses that concentrate operational failure

Price is visible. Failure modes hide in service levels that do not match your peak week, vague uptime language, data-processing terms that block export, audit rights that never get used, and auto-renew traps. You do not need to litigate every clause equally. You need the few terms that decide whether a miss becomes a recoverable incident or a trapped dependency.

20/80 pattern: a handful of terms - SLA realism, data portability, termination/exit assistance, security obligations, renewal - usually decide most post-signature pain.

Ignored majority: debating logo placement and marketing language while exit assistance and incident notification timelines stay fuzzy.

Warning sign: procurement celebrates a discount and cannot quote the uptime commitment or the data-return clock.

Action today: for your next strategic/bottleneck contract, highlight only five clauses (SLA, data out, security incident notice, termination assistance, renewal) and refuse signature until those five are clear in plain language.

A simple register after vendor pain

The only-on-8020 artifact is a vendor pain register. After a missed SLA, lock-in surprise, failed implementation, security scare, or switching-cost blowup, write one tag. Do not write a novel.

Tag	Means
class	Treated as routine when it was strategic/bottleneck (or the reverse)
criteria	Wrong weights; feature democracy; TCO ignored
proof	Demo theater; no real scenario or pilot
exit	Switching cost / single-source / export failure
security	Third-party / supply-chain security gap
contract	SLA, data, renewal, or liability surprise

Collect about a dozen tags across a couple of quarters. The next high-impact buy gets rigor on the dominant tags only.

Illustrative sample: twelve tags from one ops team - proof 4, exit 3, class 2, security 2, contract 1. Top two (proof + exit) = 7/12 ≈ 58% of pains. The next ERP shortlist required three failure-killing scenarios and a written exit story before legal redlines - not a longer feature matrix.

Checklist for the vital few

• Buy classified (strategic / bottleneck / leverage / non-critical) before demos
• Five weighted criteria frozen; nice-to-haves are tie-breakers only
• Three must-work scenarios or a time-boxed pilot for high-impact buys
• Exit story written; export or second-source path tested where possible
• Critical vendors ranked for cyber blast radius; owners assigned
• Five contract clauses clear in plain language before signature
• Pain tags feeding the next buy’s rigor - not a longer universal RFP

8020 move: This month, tag the last six vendor pains and apply only the top tag’s bottleneck to your next strategic or bottleneck buy - before adding any new log rows.

Misreads that look like diligence

“A longer RFP means a safer choice.”
Length without classification and proof is majority motion. Unequal depth on hinge buys is the point.

“If security sent a questionnaire, C-SCRM is done.”
NIST frames supply-chain cyber risk as life-cycle and criticality-aware. A filed PDF is not continuous ownership of critical suppliers.

“Lowest price on the shortlist is the 80/20 move.”
Price can matter in leverage categories. On strategic and bottleneck buys, cheap that traps you or fails the must-work scenarios is expensive.

Focus attention where vendor risk actually concentrates

Vendor selection gets useful when the few bottlenecks that dominate regret get unequal attention. Classify, weight the vital criteria, prove real scenarios, force exit honesty, put security diligence on critical providers, and clear the few contract clauses that decide failure - those are enough to reorganize a buying quarter. Portals help. They do not replace the pain register.

Start with one classification sentence, three must-work scenarios, and one exit story. That is enough to test whether concentration - not hustle, not haul culture, not another tip thread - was missing.

Sources & scope

• Kraljic matrix - overview of purchase segmentation by impact and supply risk (origin: Peter Kraljic, “Purchasing Must Become Supply Management,” HBR, 1983).
• NIST, SP 800-161 Rev. 1 - Cybersecurity Supply Chain Risk Management practices; project overview: NIST C-SCRM.
• Verizon, 2025 DBIR Executive Summary - third-party involvement in 30% of analyzed breaches (up from ~15% in the prior year’s expanded metric).
• Pain register and sample tags - practice patterns. Not legal, procurement, or compliance advice. Regulated acquisition may require process beyond this guide. Never invent a universal “20% of vendors = 80% of risk” law for your org - measure your pains.
• Composite tag counts marked Illustrative:.